Indonesia’s Online Single Submission Risk-Based Approach, commonly called OSS RBA, is the central digital system for obtaining and managing business licensing. The practical point is simple: the licence path follows the risk profile of each business activity, not merely the legal form of the company. A company may therefore receive a Business Identification Number quickly but still need a verified Standard Certificate, an operational licence, supporting approvals, or sector-specific authorisations before it may lawfully begin all planned operations.
This guide explains how OSS RBA Indonesia works under the framework led by Government Regulation No. 28 of 2025, how to read the four risk levels, and how foreign investors can prevent mismatches among their company deed, KBLI activities, project locations and operating permissions.
Key Takeaways
- OSS RBA assigns licensing requirements to each business activity according to its assessed risk level.
- A Business Identification Number, or NIB, is the business’s official identity and a core licensing document, but it is not always sufficient for commercial operations.
- Low-risk activities generally rely on the NIB; medium-risk activities generally involve an NIB and Standard Certificate; high-risk activities require an NIB and a licence before operational or commercial activity.
- The correct KBLI classification is foundational because it affects foreign ownership, risk level, licences, investment planning and reporting.
- Spatial, environmental and building requirements may need to be resolved alongside or before operational licensing, depending on the project.
- Companies should treat OSS as a compliance record that must remain aligned with actual operations, not as a one-time registration portal.
What Is OSS RBA in Indonesia?
OSS is Indonesia’s electronically integrated business licensing system. RBA refers to the risk-based approach used to determine which business permissions and standards apply. Government Regulation No. 28 of 2025 defines risk-based business licensing as licensing based on the result of a risk analysis for each business activity. The regulation replaced Government Regulation No. 5 of 2021 and took effect on 5 June 2025.
The system connects a business’s legal identity with its activities, locations, scale, investment data and licensing outputs. For a foreign-owned limited liability company, or PT PMA, the process should begin only after the founders have translated the business model into accurate Indonesian Standard Industrial Classification codes, known as KBLI codes. That classification exercise is more important than selecting a broad industry label such as “technology,” “consulting” or “trading.”
The official OSS portal states that the system groups activities into four risk levels. Investors can use the portal to review activity information, but a project-specific assessment should also account for the company deed, foreign-investment restrictions, project location, products, distribution model and sector regulations.
The Four OSS RBA Risk Levels
Risk is assessed for the activity, so one company can hold several KBLI codes with different licensing paths. The following summary is a planning guide rather than a substitute for the live OSS result for the selected activity.
| Risk level | Typical core output | What it means operationally |
|---|---|---|
| Low | NIB | The NIB generally serves as the core authority for the low-risk activity, subject to any applicable supporting requirements. |
| Medium-low | NIB and Standard Certificate | The business makes the required standards commitment through OSS and must operate consistently with those standards. |
| Medium-high | NIB and verified Standard Certificate | The relevant authority verifies fulfilment of the applicable business or product standards before the activity reaches the required operational status. |
| High | NIB and licence | The business must satisfy the licence requirements before beginning the relevant operational or commercial activity. |
A Standard Certificate is not merely decorative evidence. Its status matters. For medium-high-risk activities, a certificate awaiting verification should not be read as equivalent to a verified certificate. Likewise, a high-risk company that has an NIB but has not obtained the required licence has not completed the operational licensing route for that activity.
What an NIB Does and Does Not Do
The NIB is the official identity assigned to a business through OSS. Under the implementing rules in Minister of Investment and Downstream Industry/BKPM Regulation No. 5 of 2025, each business entity has one NIB. The NIB can also connect to functions identified in the current framework, including customs access and importer identification where the applicable requirements are met.
However, “having an NIB” and “being ready for every planned operation” are different conclusions. A manufacturer may need environmental approval, building approvals, an effective Standard Certificate or licence, and product-related approvals. An importer may need the appropriate importer configuration and commodity-specific permissions. A regulated product business may need registrations beyond the core business licence. Use IndoGateway’s Indonesia licence checker as an initial discovery tool, then verify the result for the exact activity and project.
How to Apply Through OSS RBA
- Define the operating model. Document what the Indonesian entity will sell, manufacture, import, distribute, install or support; who contracts with customers; and where each activity occurs.
- Select the exact KBLI codes. Match each revenue-generating and operational activity to the current classification. Indonesia introduced KBLI 2025 through BPS Regulation No. 7 of 2025, so legacy mappings should be checked during the transition.
- Screen foreign ownership and investment requirements. For a PT PMA, confirm whether every chosen activity is open to the intended foreign shareholding and whether sector-specific capital or investment conditions apply.
- Align corporate documents. Ensure the deed, Ministry of Law record, taxpayer information, shareholder data and business purposes support the proposed OSS entries.
- Enter the project and location data. Record the investment plan, address, land or premises information, workforce and other requested project details consistently.
- Resolve basic requirements. Spatial conformity, environmental approval and building-related approvals may apply according to the location, land use, construction plan and environmental impact.
- Obtain the licensing output. Complete the route assigned to each KBLI, including standards submissions, verification or licence requirements where applicable.
- Check effectiveness before launch. Confirm that each activity’s status permits the intended preparation, operational or commercial stage.
- Maintain the record. Update OSS when material data changes and coordinate the record with investment reporting and sector compliance.
Basic Requirements That Can Affect the Licensing Sequence
OSS RBA does not remove the physical and environmental dependencies of a project. The framework coordinates basic requirements that may include spatial-use conformity, environmental approval and building approvals. Which instruments apply depends on factors such as project location, land status, building work, activity scale, process, emissions, waste and environmental impact.
This is especially important for industrial and site-intensive projects. A company planning a factory should evaluate licensing together with land due diligence, utilities, environmental instruments, construction approvals and operational readiness. IndoGateway’s guidance on factory, construction and environmental approvals helps investors view these dependencies as one project rather than disconnected forms.
Product and import workstreams can also run in parallel. An entity may be validly established while its products cannot yet be placed on the market. Depending on the goods, the commercial route may involve import licensing, standards, halal, BPOM or other sector controls. The appropriate sequence should be designed before inventory is shipped or commercial commitments are made.
Common OSS RBA Mistakes
Choosing a KBLI Because Its Label Sounds Close
The title of a KBLI code is not enough. Review its description, inclusions and exclusions against actual contracts, goods, services and transaction flows. A superficially similar code can have a different ownership position, risk level or licence path.
Treating the NIB as Universal Permission
The NIB is essential, but it does not replace a verified Standard Certificate, high-risk licence, basic requirement or product approval where one applies. Check the status and effectiveness of every output.
Registering Too Many Activities Without an Operating Rationale
A long list of speculative KBLI codes can increase screening work, create investment-plan questions and complicate compliance. Register activities that are genuinely intended and supported by the company structure.
Using Inconsistent Data Across Systems
Differences among the deed, OSS, tax records, location records and sector submissions can delay verification or create future amendment work. Establish a controlled company data sheet and use it consistently.
Ignoring Post-Licensing Obligations
Licensing does not end when documents are issued. Companies may need investment activity reports, standards compliance, renewals, updates, sector reports or responses to supervision. Build ownership and deadlines into the compliance calendar.
A Practical Readiness Checklist
- A written description of each Indonesian revenue and operational flow
- Validated current KBLI mapping for every activity
- Foreign ownership screening for each activity
- Company deed and Ministry of Law data aligned with the business scope
- Project address, premises rights and spatial position checked
- Environmental and building dependencies identified
- Investment values and funding plan supported by a realistic budget
- Required Standard Certificates, licences and PB UMKU mapped
- Product, import, workforce and immigration dependencies mapped
- Responsibility assigned for OSS maintenance and investment reporting
For a coordinated setup and licensing review, see IndoGateway’s NIB and OSS business licensing service and PT PMA company registration support.
Frequently Asked Questions
1. What does OSS RBA mean in Indonesia?
OSS RBA means the Online Single Submission system operating with a Risk-Based Approach. It is Indonesia’s integrated digital mechanism for issuing and administering business licensing according to the assessed risk of each business activity. The system links the business entity, its KBLI classifications, project locations and licensing outputs. It does not mean that every permission is automatically issued or that one document covers all operations. Medium-high and high-risk activities can require verification or approval, while spatial, environmental, building, product, import and other sector requirements may still apply.
2. Is an NIB enough to start doing business?
An NIB may be sufficient as the core business licence for a low-risk activity, but it is not a universal authorisation for every company or activity. Medium-risk activities generally require a Standard Certificate, and high-risk activities require the relevant licence before operational or commercial activity. Separate basic requirements and supporting business licences may also apply. The reliable test is to review the live OSS status for every registered KBLI and then confirm any sector, product, location and operational dependencies. A company should not infer full readiness solely because an NIB PDF has been generated.
3. What is the difference between medium-low and medium-high risk?
Both categories generally involve an NIB and a Standard Certificate, but the verification route differs. For medium-low risk, the certificate is generally based on the business’s commitment to satisfy the applicable standards. For medium-high risk, the relevant authority verifies fulfilment of the standards, so the certificate’s status is operationally important. The exact standards, documents and competent authority depend on the KBLI and sector. Investors should check whether a certificate is unverified, pending or verified and should avoid treating a submission acknowledgement as proof that commercial operations may begin.
4. Can one company have activities with different OSS risk levels?
Yes. Risk classification attaches to the business activity rather than being a single permanent label for the legal entity. A company with several KBLI codes can therefore have a low-risk activity, a medium-risk activity and a high-risk activity in the same OSS profile. Each activity must reach the licensing status required for its own operations. This makes activity-level tracking essential: management should maintain a matrix showing the KBLI, project location, risk level, required output, current status, responsible owner and any supporting licences or approvals.
5. How does KBLI selection affect OSS licensing?
KBLI selection is one of the most consequential OSS decisions because it describes the economic activity that the company is registering. The chosen code can influence risk classification, licensing outputs, foreign ownership screening, minimum investment calculations, reporting and sector supervision. The title alone may not capture the code’s boundaries, so the description and exclusions should be compared with actual contracts and operations. During the KBLI 2025 transition, existing companies should also check the official correspondence between older and newer classifications and confirm how OSS has mapped their data.
6. Does OSS also issue product registrations and import approvals?
OSS can provide or connect access to certain supporting business licences and sector processes, but investors should not assume that the NIB itself authorises all imports or product sales. The required route depends on the product, commodity, applicant role and distribution structure. Food, cosmetics, medical devices, telecommunications equipment and products subject to mandatory standards can involve different authorities and approvals. Map business licensing and product market access together, identify which entity will be the importer or registration holder, and complete the necessary permissions before shipping or commercial distribution.
7. What happens when a company changes address or adds a new activity?
The company should assess and update the affected corporate and OSS records rather than simply operating under the old data. An address change can affect spatial conformity, environmental requirements, authority jurisdiction and project-location licensing. A new activity can introduce a different KBLI, ownership restriction, risk level, investment plan or sector licence. The amendment sequence depends on whether the deed and Ministry of Law record also need to change. Before submitting updates, compare all master data and preserve copies of prior approvals so that the revised record remains consistent and auditable.
8. How long does OSS RBA licensing take?
There is no reliable universal timeline for OSS RBA licensing. A low-risk activity with clean and consistent data can follow a much shorter route than a high-risk industrial project requiring land, environmental, building and sector verification. Timing also depends on document readiness, the exact KBLI, location, authority review and whether corrections are requested. Businesses should plan by workstream and dependency instead of relying on a single promised duration. A readiness review before filing often saves more time than accelerating an application built on incomplete classifications or inconsistent project information.
Conclusion
OSS RBA Indonesia is best understood as an activity-level licensing and compliance framework. The strongest applications begin with a precise operating model, correct KBLI classifications and consistent company and project data. The NIB is foundational, but the right to proceed can depend on standards verification, a licence, basic requirements and sector or product approvals. Foreign investors should therefore design corporate setup, licensing, location, import, product and reporting workstreams together.
Plan Your Indonesia Licensing Route
IndoGateway can help align your entity, KBLI scope, OSS record and related operating approvals into one practical market-entry plan. Contact IndoGateway to discuss your activities, ownership structure, project locations and launch priorities.
